CVE-2005-3001

The CVE-2005-3001 vulnerability affects Solaris 10’s tl driver (SunOS 5.10) and can trigger a local denial-of-service (panic) via unknown vectors. Public documentation in vendor/IDS feeds confirms affected platforms are Solaris 10 on SPARC and x86, with patch-based mitigations issued as SunOS sun...

CVE-2005-3001

Unspecified vulnerability in the "tl" driver in Solaris 10 allows local users to cause a denial of service panic via unknown vectors...

CVE-2005-2870

Unknown vulnerability in the net-svc script on Solaris 10 allows remote authenticated users to execute arbitrary code on a DHCP client via certain DHCP responses...

CVE-2005-2870

Unknown vulnerability in the net-svc script on Solaris 10 allows remote authenticated users to execute arbitrary code on a DHCP client via certain DHCP responses...

CVE-2005-2870

Solaris 10 is affected by CVE-2005-2870 in the net-svc DHCP client. The vulnerability stems from improper sanitization of data in DHCP replies, allowing remote authenticated users to execute arbitrary code on a DHCP client. The referenced patches to mitigate the issue are Sun patch 119593-01 for ...

Solaris 10 (x86) : 119720-01

SunOS 5.10x86: patch kernel/misc/kmdbmod. Date this patch was last updated by Sun : Aug/18/05 %NASLMINLEVEL 70300 @DEPRECATED@ This script has been deprecated as the associated patch is not currently a recommended security fix. Disabled on 2011/09/17. C Tenable Network Security, Inc. if !...

Solaris 10 (x86) : 120295-01

SunOS 5.10x86 : mysql man patch. Date this patch was last updated by Sun : Aug/04/05 %NASLMINLEVEL 70300 @DEPRECATED@ This script has been deprecated as the associated patch is not currently a recommended security fix. Disabled on 2011/09/17. C Tenable Network Security, Inc. if !...

Solaris 10 (sparc) : 118666-86 (deprecated)

JavaSE 5.0: update 85 patch equivalent to JDK 5.0u85. Date this patch was last updated by Sun : Apr/13/15 This plugin has been deprecated and either replaced with individual 118666 patch-revision plugins, or deemed non-security related. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

Solaris 10 (sparc) : 120469-07

SunOS 5.10: kerberos patch. Date this patch was last updated by Sun : Apr/10/07 %NASLMINLEVEL 70300 @DEPRECATED@ This script has been deprecated as the associated patch is not currently a recommended security fix. Disabled on 2011/09/17. C Tenable Network Security, Inc. if ! definedfunc"bnrandom"...

Solaris 10 (sparc) : 118560-02

SunOS 5.10: usr/bin/telnet patch. Date this patch was last updated by Sun : Sep/14/06 %NASLMINLEVEL 70300 @DEPRECATED@ This script has been deprecated as the associated patch is not currently a recommended security fix. Disabled on 2011/09/17. C Tenable Network Security, Inc. if !...

CVE-2005-2071

CVE-2005-2071 affects Sun Solaris 10 on x86 where traceroute can allow a local user to run arbitrary code with PRIV_NET_RAWACCESS by supplying a large number of -g arguments or a malformed -s argument with a trailing dot. Connected advisories document patches: Solaris 10 (x86) 121013-03 and Solar...

CVE-2005-2071

traceroute in Sun Solaris 10 on x86 systems allows local users to execute arbitrary code with PRIVNETRAWACCESS privileges via 1 a large number of -g arguments or 2 a malformed -s argument with a trailing . dot...

ldsoWhoops.txt

ld.so from Solaris 9 and 10 doesn't check LDAUDIT environment variable when running sugid binaries, allowing to run arbitrary code with elevated privileges. Well, I can't belive, that such trivial vulnerability exists in modern OS... The following PoC code was tested on: - SunOS 5.10 Generic i86p...

Solaris 9 / 10 ld.so Local Root Exploit (2)

Exploit for solaris platform in category local exploits =========================================== Solaris 9 / 10 ld.so Local Root Exploit 2 =========================================== / Solaris 9 on SPARC: $ cat dupa.c / char sh = / setuid / "\x90\x08\x3f\xff\x82\x10\x20\x17\x91\xd0\x20\x08" /...

Solaris 9 / 10 ld.so Local Root Exploit (1)

Exploit for solaris platform in category local exploits =========================================== Solaris 9 / 10 ld.so Local Root Exploit 1 =========================================== / - SunOS 5.10 Generic i86pc i386 i86pc - SunOS 5.9 Generic112233-12 sun4u It does NOT work on: SunOS 5.8...

Solaris 10 /usr/sbin/traceroute vulnerabilities

/usr/sbin/traceroute from Solaris 10 is vulnerable to buffer overflow in handling -g argument. After supplying 10 -g parameters, return address is overwritten by IP address argument: atari:root:/home/venglin /usr/sbin/traceroute -g 1 -g 2 -g 3 -g 4 -g 5 -g 6 -g 7 -g 8 -g 9 -g 10 127.0.0.1...

traceSolaris.txt

/usr/sbin/traceroute from Solaris 10 is vulnerable to buffer overflow in handling -g argument. After supplying 10 -g parameters, return address is overwritten by IP address argument: atari:root:/home/venglin /usr/sbin/traceroute -g 1 -g 2 -g 3 -g 4 -g 5 -g 6 -g 7 -g 8 -g 9 -g 10 127.0.0.1...

CVE-2005-1887

Unknown vulnerability in the Sun Solaris C library libc and libproject in Solaris 10 allows local users to gain privileges...

CVE-2005-1887

Unknown vulnerability in the Sun Solaris C library libc and libproject in Solaris 10 allows local users to gain privileges...

Solaris 10.x - ESRI Arcgis Format String Privilege Escalation

Solaris 10.x - ESRI Arcgis Format String Privilege Escalation / ESRI 9.x Arcgis local root format string exploit Copyright Kevin Finisterre and John H. Bug found by Kevin Finisterre Exploit by John H. We overwrite the thrjmptable Tested on solaris 10 / include include include include include...